AI Threat AlertCVE-2026-110196: Langflow: authz bypass enables RCE via code component
HIGHIBM Langflow OSS 1.0.0 through 1.12.4 has a missing-authorization flaw (CWE-862) that lets any low-privileged authenticated user get around the administrator-only restriction and run arbitrary code on the server by configuring a built-in code-execution component with attacker-supplied inputs. With CVSS 8.8, network reachability, low complexity and no user interaction, this effectively turns any ordinary Langflow account into server-level code execution. There is no EPSS score, KEV listing, public exploit or Nuclei template yet, so active exploitation is unconfirmed, but past Langflow code-execution bugs were weaponized quickly once details became public. Upgrade to the fixed release listed in the IBM advisory (ibm.com/support/pages/node/7293016), and until then restrict account creation, audit existing low-privilege users, and keep Langflow off the internet.
What is the risk?
High. Exploitation is low complexity and needs only a low-privileged account, with no user interaction. Impact is full confidentiality, integrity and availability loss on the Langflow host. Exposure depends on who can register or hold accounts: multi-user or internet-facing deployments with open sign-up are at greatest risk. No exploitation evidence (KEV, public PoC, scanner template, SSVC) is available at publication, so risk is driven by severity and the product's history rather than observed attacks. EPSS data is missing and should be rechecked as it is published.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| Langflow | pip | — | No patch |
Do you use Langflow? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 step1) Upgrade Langflow OSS to the fixed version named in IBM advisory 7293016 (anything newer than 1.12.4). 2) Until patched, disable open registration, limit accounts to trusted users, and put Langflow behind VPN or SSO-gated access. 3) Review and remove unneeded low-privilege accounts. 4) Run Langflow in a hardened container with a non-root user, minimal egress, and no broad cloud credentials. 5) Rotate API keys and secrets stored in or reachable from Langflow if compromise is suspected. 6) Detection: audit flows and components for newly created or modified code-execution components by non-admin users, and monitor for unexpected child processes, outbound connections and shell activity from the Langflow process.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-110196?
IBM Langflow OSS 1.0.0 through 1.12.4 has a missing-authorization flaw (CWE-862) that lets any low-privileged authenticated user get around the administrator-only restriction and run arbitrary code on the server by configuring a built-in code-execution component with attacker-supplied inputs. With CVSS 8.8, network reachability, low complexity and no user interaction, this effectively turns any ordinary Langflow account into server-level code execution. There is no EPSS score, KEV listing, public exploit or Nuclei template yet, so active exploitation is unconfirmed, but past Langflow code-execution bugs were weaponized quickly once details became public. Upgrade to the fixed release listed in the IBM advisory (ibm.com/support/pages/node/7293016), and until then restrict account creation, audit existing low-privilege users, and keep Langflow off the internet.
Is CVE-2026-110196 actively exploited?
No confirmed active exploitation of CVE-2026-110196 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-110196?
1) Upgrade Langflow OSS to the fixed version named in IBM advisory 7293016 (anything newer than 1.12.4). 2) Until patched, disable open registration, limit accounts to trusted users, and put Langflow behind VPN or SSO-gated access. 3) Review and remove unneeded low-privilege accounts. 4) Run Langflow in a hardened container with a non-root user, minimal egress, and no broad cloud credentials. 5) Rotate API keys and secrets stored in or reachable from Langflow if compromise is suspected. 6) Detection: audit flows and components for newly created or modified code-execution components by non-admin users, and monitor for unexpected child processes, outbound connections and shell activity from the Langflow process.
What systems are affected by CVE-2026-110196?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, LLM workflow builders, RAG pipelines, multi-user AI development platforms.
What is the CVSS score for CVE-2026-110196?
CVE-2026-110196 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.46%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0012Valid AccountsAML.T0049Exploit Public-Facing ApplicationAML.T0050Command and Scripting InterpreterCompliance Controls Affected
What are the technical details?
Original Advisory
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker with a low-privileged authenticated account to bypass the administrator-only restriction and execute arbitrary code on the server by configuring a built-in code-execution component with attacker-supplied inputs.
Exploitation Scenario
An attacker obtains a low-privileged Langflow account, for example through open sign-up, a phished credential or a compromised contractor login. They create or edit a flow and add the built-in code-execution component, which should be restricted to administrators, supplying a payload as its input. Triggering the flow runs the payload on the server, and the attacker harvests LLM API keys and vector DB credentials from the environment, opens a reverse shell, and moves laterally into internal data stores. They may also leave a modified flow as persistence.
Weaknesses (CWE)
CWE-862 — Missing Authorization: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
- [Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
- [Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HReferences
Timeline
Related Vulnerabilities
CVE-2026-1056110.0Langflow: auth bypass + unauthenticated RCE (CVSS 10)
Same package: langflowCVE-2026-1013410.0Langflow: unauthenticated RCE via tool_code injection
Same package: langflowCVE-2026-333099.9langflow: Path Traversal enables file access
Same package: langflowCVE-2026-552559.9Langflow: IDOR allows cross-user flow execution
Same package: langflowCVE-2026-78739.9Langflow: authenticated RCE enables credential theft
Same package: langflow